Obsolete Access Rights

Users retain access rights long after they are business-appropriate.

Users move through organizations, and as they do so they require
new access rights and no longer need old ones. Users can be counted
on to request new access rights, as without them they cannot do their
jobs. Unfortunately, users never call IT support to ask for old
rights to be revoked. Consequently, users accumulate rights over
time -- the more often their role changes, the more rights they
retain.